Maven Org.apache.struts:struts2-core vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Maven Org.apache.struts:struts2-core: 7 record(s), with affected versions and fixes.
CVE-2025-66675
High · 8.2
CWE-459 Dec 10, 2025
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
CVE-2025-64775
High · 7.5
CWE-459 Dec 1, 2025
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
CVE-2020-17530
Critical · 9.8
KEV Urgent · 79 Public exploit CWE-917 Dec 10, 2020
Apache Struts Remote Code Execution Vulnerability
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVE-2018-11776
High · 8.1
KEV Urgent · 76 Public exploit Aug 22, 2018
Apache Struts Remote Code Execution Vulnerability
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVE-2017-5638
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-755 Mar 10, 2017
Apache Struts Remote Code Execution Vulnerability
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2016-3081
High · 8.1
KEV Urgent · 76 Public exploit CWE-77 Apr 26, 2016
Apache Struts Command Injection Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2012-0391
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-94 Jan 8, 2012
Apache Struts 2 Improper Input Validation Vulnerability
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.